kongkxandClaude Opus 5
6379e8c147
Project preview instances (gig-platform, gig-app) publish no host ports; they join an external `edge` Docker network under instance-qualified aliases. - Caddy joins `edge` and loads per-project sites from sites/*.caddy. It is the LAN entry: split DNS → Caddy → instance, by hostname label. - New preview tunnel, `cloudflared-preview`, on `edge` only. It routes public instance hostnames straight to their aliases, so public previews do not depend on Caddy, and the connector cannot reach Caddy, the host or LAN services. The infra tunnel keeps fronting the host's own services via Caddy and has no route to instances. - sites/gig-platform.caddy and sites/gig-app.caddy mirror gig-platform's docs/deploy/caddy/. - The old host-port gig blocks move to sites/legacy-gig.caddy, to delete at gig-platform's main cutover. - Global client-IP trust for requests arriving through cloudflared. Validated with the custom Cloudflare-DNS build (`caddy validate`). Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01MTExEkPpPMV4gSdfHpztra
87 lines
2.3 KiB
Caddyfile
87 lines
2.3 KiB
Caddyfile
{
|
|
email {$ACME_EMAIL:[email protected]}
|
|
|
|
servers {
|
|
# cloudflared and Docker's gateways sit on private ranges. Take the real
|
|
# client IP from their headers instead of reporting their own address;
|
|
# upstreams receive it in X-Forwarded-For.
|
|
trusted_proxies static private_ranges
|
|
client_ip_headers Cf-Connecting-Ip X-Forwarded-For
|
|
}
|
|
}
|
|
|
|
# Reusable TLS block using Cloudflare DNS-01 ACME challenge (Let's Encrypt / ZeroSSL)
|
|
(cloudflare_tls) {
|
|
tls {
|
|
dns cloudflare {env.CLOUDFLARE_API_TOKEN}
|
|
}
|
|
}
|
|
|
|
# Synotrip (PHP 8.3 / MariaDB / Redis)
|
|
synotrip.kucial.com {
|
|
import cloudflare_tls
|
|
reverse_proxy host.docker.internal:3200
|
|
}
|
|
|
|
npm.kucial.com {
|
|
import cloudflare_tls
|
|
reverse_proxy host.docker.internal:4873
|
|
}
|
|
|
|
# Blog (PHP 8.3 / MariaDB)
|
|
blog.kucial.com {
|
|
import cloudflare_tls
|
|
reverse_proxy host.docker.internal:3201
|
|
}
|
|
|
|
|
|
# Gitea on Z2Pro
|
|
gitea.kucial.com {
|
|
import cloudflare_tls
|
|
reverse_proxy 192.168.50.228:8081
|
|
}
|
|
|
|
*.ddev.kucial.com {
|
|
tls {
|
|
dns cloudflare {env.CLOUDFLARE_API_TOKEN}
|
|
}
|
|
|
|
@api host gig-api.ddev.kucial.com
|
|
handle @api {
|
|
reverse_proxy https://192.168.50.160:443 {
|
|
header_up Host gig-platform.ddev.site
|
|
transport http {
|
|
tls_server_name gig-platform.ddev.site
|
|
# The public device-facing certificate is still fully trusted.
|
|
# This applies only to the fixed, private Caddy-to-DDEV hop.
|
|
tls_insecure_skip_verify
|
|
}
|
|
}
|
|
}
|
|
|
|
@socket host gig-socket.ddev.kucial.com
|
|
handle @socket {
|
|
reverse_proxy http://192.168.50.160:6001 {
|
|
header_up Host gig-platform.ddev.site
|
|
}
|
|
}
|
|
|
|
@static host gig-static.ddev.kucial.com
|
|
handle @static {
|
|
reverse_proxy https://192.168.50.160:443 {
|
|
header_up Host gig-platform.ddev.site
|
|
transport http {
|
|
tls_server_name gig-platform.ddev.site
|
|
tls_insecure_skip_verify
|
|
}
|
|
}
|
|
}
|
|
|
|
respond 404
|
|
}
|
|
|
|
# Per-project sites, one file each (sites/*.caddy). Project instances are
|
|
# reached over the shared `edge` Docker network by container alias rather than
|
|
# host ports — see sites/gig-platform.caddy.
|
|
import sites/*.caddy
|